PrivScan is an automated privacy scanning tool for SaaS websites, mainly helping product and privacy teams uncover GDPR gaps on public pages before diligence. It is positioned as a decision-support tool, not legal advice, a DPO replacement, or a compliance certificate.
Purpose PrivScan is aimed at SaaS founders and marketers who need to prepare public pages before privacy due diligence. It scans a public site or app interface, checks the compliance of cookie banners, consent flows, trackers, and data collection statements, and provides a readiness score and remediation checklist based on the subject matter of the provisions in the GDPR (EU Regulation 2016/679). The official emphasis is that this is decision support and cannot guarantee that drafted policies will satisfy all regulators or auditors.
Main capabilities
- Cookie/consent review: checks whether banners provide granular opt-in for non-essential cookies.
- Missing legal bases: identifies cases where the GDPR Article 6 basis is vague or does not match actual processing.
- Outdated privacy policies: for example, processing activities introduced by AI features are not described in the statement.
- Late due diligence findings: helps enterprise buyers with issues discovered only after the sales cycle has begun.
- Provision references: provides pointers to GDPR topics for manual follow-up.
- Remediation checklist: generates a prioritized list that can be assigned to owners.
- Readiness score: a score based on the subject matter of provisions, with a remediation checklist.
- Output export: the prioritized list can be exported for lawyer review.
How to use it The official description says "from URL to remediation checklist in just 3 steps": point PrivScan at a public website or app interface; use deterministic gap rules plus optional model-assisted narrative; export the prioritized list, with lawyers always involved in the process. Users can start by signing up via email or with Demo mode in the Studio, then upgrade later. The Demo is clearly labeled, and live narrative requires configuring an AI key. The Free/Pro plans include AI runs under a platform key, while Enterprise can optionally bring its own OpenAI key (BYOK), configured in /settings, with the key kept only on the server side.
Plans and quotas The official page shows pricing starting at $0 (Free). All paid plans include: the GDPR Readiness Studio, a gap checklist with provision references, remediation priorities (decision support), email support for paid plans, and limited daily AI runs (10/day · 50/month). Pro includes about 300 AI generations/month (with a daily cap), using gpt-4o-mini. If fair-use limits are reached, the Studio returns simulated/demo results until the daily or monthly reset, or until an upgrade/use of Enterprise BYOK. Team seats and API access are marked as roadmap. Paid licenses are issued manually after payment confirmation, usually sent to the purchase email within a few hours, and no account is needed to activate Pro. Payments are processed by Waffo Pancake as merchant of record.
Use cases Suitable for SaaS products and privacy officers preparing for an EU launch, compliance engineers, and teams that need a first-round GDPR readiness review before privacy diligence. By default it handles EU GDPR Art. 6 / 7 / 13–14 topics, with UK GDPR optional where provided.
Limitations PrivScan is not a law firm, a GRC platform, or an ISO certification body; it does not guarantee that policies satisfy all regulators or auditors; it does not constitute legal advice, a DPO replacement, or a compliance certificate. Where DPIA and filings are involved, a qualified privacy lawyer should be used. Scanning is based on public pages and the data practices/trackers described by the user. The official site also notes that social proof uses templates until there are real, consented testimonials.
Some facts (such as specific classification attribution and the actual availability status of team seats and API) are not yet provided or are marked as roadmap, and the latest official information should be relied upon.